Make (most) containers run with a read-only filesystem

roles/matrix-postgres/tasks/import_postgres.yml

@@ -73,7 +73,7 @@
 
 - name: Note about Postgres importing alternative
   debug:
-    msg: >
+    msg: >-
       Importing Postgres database using the following command: `{{ matrix_postgres_import_command }}`.
       If this crashes, you can stop Postgres (`systemctl stop matrix-postgres`),
       delete its existing data (`rm -rf {{ matrix_postgres_data_path }}/*`), start it again (`systemctl start matrix-postgres`)

roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2

@@ -11,9 +11,12 @@ ExecStart=/usr/bin/docker run --rm --name matrix-postgres \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
+			--read-only \
+			--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
+			--tmpfs=/run/postgresql:rw,noexec,nosuid,size=100m \
 			--network={{ matrix_docker_network }} \
 			--env-file={{ matrix_postgres_base_path }}/env-postgres-server \
-			-v {{ matrix_postgres_data_path }}:/var/lib/postgresql/data \
+			-v {{ matrix_postgres_data_path }}:/var/lib/postgresql/data:rw \
 			-v /etc/passwd:/etc/passwd:ro \
 			{{ matrix_postgres_docker_image_to_use }}
 ExecStop=-/usr/bin/docker stop matrix-postgres